Demo — sample data, resets nightly About this demo Next reset: Mon Nov 2, 2026, 3:15 AM

SportsMgnt

Security overview

SportsMgnt has not been audited for SOC 2, HIPAA or PCI DSS and holds no such certification or attestation. This page describes the controls built into the demo.

Connections

  • HTTPS only, with a Let's Encrypt certificate and HTTP Strict Transport Security.
  • A Content Security Policy that allows no inline scripts and no other websites.

Accounts and sign-in

  • Passwords are hashed with Argon2id and checked against a list of the 10,000 most common passwords.
  • After 5 failed sign-ins, the account and the network address pause for 15 minutes.
  • Optional two-step sign-in with an authenticator app (TOTP) and single-use recovery codes; required for the owner account.
  • Forms are protected against cross-site request forgery.

Access control

  • Roles are granted per location, area, region or district, and every record is checked against the signed-in user before it is shown.
  • Read-only supervisors cannot change anything, and refunds need three different people.

Data protection

  • Medical notes, allergies and two-step secrets are encrypted in the database (AES-256).
  • Uploaded documents are encrypted on disk (AES-256-GCM), stored outside the website folder and downloaded only by authorized users; each view is logged.
  • No card numbers: the demo payment processor uses sample instruments only, so there is no card data to protect.
  • Network addresses used for rate limits are stored only as salted hashes.

Audit

  • Every sign-in, change, approval, refund, export and document view writes an audit row. Each row includes a hash of the previous one, so a changed row is detected by "Verify chain".

API

  • Tokens are shown once, stored only as hashes, limited by scopes and an expiry of at most 90 days, and can be revoked. Requests are rate limited.

Email

  • The demo cannot email the public: only walkthrough-request notices and server alerts can leave the server, and only to WeldonPC.

Report a problem

If you find a security problem, tell us with the walkthrough request form. Please do not test attacks against the live demo. Request a walkthrough